IDS and Penetration Testing Lab III Snort Lab Purpose: In this lab, we will explore a common free Intrusion Detection System called Snort. Snort was written initially for Linux/Unix, but most functionality is now available in Windows. In this lab, we will use the windows version, but there is an extra credit section to setup and use Snort on Linux (See Extra Credit Section). Software Requirements: Use of VCL is sufficient but for your personal use we include Microsoft Windows Installation notes. WinIDS AIO Software Pack which mainly includes the following: 1. Snort 2. Active Perl 3. Oinkmaster The package will be provided you (WinIDS AIO); you may also download it from: http://www.winsnort.com 2. WinPcap. If you already installed Wireshark on the Windows XP machine, then you probably already have it. To verify go to Start > Control Panel > Add Remove Programs to check. If not, then download it from here: http://www.winpcap.org/install/default.htm
3. Wireshark. Download from: http://www.wireshark.org/ Lab Exercise: 1. In your WinIDS_Support_Pack folder, install Snort by double- clicking on the Snort Installer file. Keep defaults values. 2. Snort has three main modes of operations. The sniffer mode, the packet logger mode, and the Network Intrusion Detection mode. Do some reading on these modes (http://www.snort.org/docs/snort_manual/node2.html) 3. Snort Modes: a. Sniffer Mode: 1. In a command prompt, cd to c:\snort 2..\bin\snort help >>> View different options for snort. 3. Use the appropriate flag to list available interfaces. (What flag did you use? ) 4. Run snort in the sniffer mode by typing.\bin\snort v i2 Important: Note that you need to replace the i2 with whichever your network interface is (see point 3 above). Also note that this lab assumes that you are not using a wireless interface. If you want to use a wireless NIC card, then you need to install a Pcap for wireless traffic like AirPcap. You should see something like this:
5. Ctrl c will stop the capture. Notice that no data- link headers are being displayed. Find the flag that will also display data- link headers as well as the raw packets in HEX/ASCII. What command/flags did you use? b. Packet Logger Mode: 1. In this mode, Snort will log some activities to a log directory. If you look at the c:\snort\log directory, it should be empty. Type a snort command that will start snort in the Logger mode. (don't forget to specify the output directory.\log after the appropriate flag; also don't forget to specify the right interface). What command did you type?
2. To get some logs, open up a browser and go to www.gmu.edu. 3. Ctrl + c to stop Snort. Now look at the \log directory, you should see some Snort. log files. These files are Capture files and you can import them into Wireshark to view details. Open up Wireshark and import the log file that was just created. Can you see the page request to www.gmu.edu? Provide a snap shot. c. IDS Mode: 1. In the Snort Network Intrusion Detection Mode, Snort uses some configuration files and a set of Rule's files. The configuration files will help configure different options in Snort. The Rule's files are files that include signatures against which Snort is comparing all captured traffic. We will be writing some of these signatures. If some traffic pattern matches some signature, a Snort "alert" will be fired. Snort also has Preprocessors also. Preprocessors will check flow of traffic as well. For example if an attacker sends a packet that has "user:" and then later sends another one that has "root". If there is a Snort signature to trigger on text content: "user: root". It will not catch this attempt of remotely trying to access resources with root privileges. The 'Preprocessor' will try to process the stream of data, and reassemble it before it goes into the detection engine, so it detects such tricks of evading the IDS. As a matter of fact, there is an excellent paper that discusses IDS evasion. Read this article that summarizes it: http://www.securityfocus.com/infocus/1852 2. Look at the main Snort configuration file under c:\snort\etc\snort.conf. There is a line that specifies the Rule's path: var RULE_PATH../rules. Change this line to read: var RULE_PATH c:\snort\rules
This tells the Snort engine where to find the Rules files. If you look at the rules folder now, it should be empty. You can populate it by using a Perl script called Oinkmaster. This script automatically goes to the Snort website to get more rules. We will take the time here to get Oinkmaster up and running to load the rules files. To do this, follow the following steps: A) Install Active Perl. Note that Active Perl is part of the package that you have already downloaded. Also install Oinkmaster which is also part of that package. (Hint: a very useful document is the README.win32 under the following directory ( _Support_Pak- 081007\oinkmaster- 2.0\oinkmaster). B) You need to make a change on the "oinkmaster.conf" file. To specify the URL from which you will download the rules. But to be able to do this, you need to be registered (with a snort username and password). Go ahead and create an account for yourself in the snort website www.snort.com. Once you create the account and login to it, you can scroll to the bottom of the page and click on get Oink Code. This will give you the Oink Code that you will use in your "oinkmaster.conf" file. Once you have this code, replace the <oinkcode> on the line shown below with the new code you just got: # Example for Snort-current ("current" means cvs snapshots). # url = http://www.snort.org/pub-bin/oinkmaster.cgi/<oinkcode>/snortrulessnapshot-current.tar.gz C) Now you can execute the Oinkmaster script to go out and get the rules by executing the following line (Note, the path might be different for you): (Format is: [Perl] [Source Perl script] [output]) c:\perl\bin\perl c:\winids_support_pak- 081007\oinkmaster- 2.0\oinkmaster.pl - o c:\snort\rules. Please note that if some folder names have spaces, you need to include the path in double quotes, like: "My documents". This should start installing the Snort rules and the rules file should be populated.
3. There are some minor changes that need to take place in the "Snort.conf" file. To make it simple, just delete the entire file and create the one provided. 4. Now run snort in the Network IDS mode by typing the following:.\bin\snort c.\etc\snort.conf 5. Keep snort running as an IDS and let s trigger an alert. An easy trick to trigger an alert is to open up your browser and type: www.gmu.edu/readme.eml The following signature from the web- client.rules file should trigger: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"web-client readme.eml download attempt"; flow:from_client,established; uricontent:"/readme.eml"; nocase; reference:url,www.cert.org/advisories/ca- 2001-26.html; classtype:attempted-user; sid:1284; rev:10;) EXTRA CREDIT Go ahead and stop Snort (Ctrl + c). No go to the Log directory and you should see "alert.ids" file. Open the file and you should see more details on the alert. Create the Snort Signatures for the rbot IRC botnet.